Skip to main content
Request a demo
Financial assets

Private Credit Tokenization

Direct lending exposure issued as a token, with amortisation, uneven cashflows and default handling treated as normal rather than exceptional.

Standards, ordered by control over a transferFour token standards as rungs, from one where anyone may hold up to one where a transfer can be refused by the contract itself.ERC-20anyone may holdERC-1155batched, still openERC-4626a vault around oneERC-3643a transfer can be refused

Definition

Private credit tokenization represents an interest in a loan or a pool of loans that are not publicly traded. Unlike a bond, the cashflows are usually uneven — amortising principal, variable rates, prepayments and occasionally defaults — and the servicing burden is correspondingly higher.

What it solves

  1. Access to an institutional-only assetDirect lending has been the preserve of investors able to commit large amounts for years at a time.
  2. Opaque loan performanceInvestors in a credit fund often see performance quarterly and in aggregate. A per-loan register makes the position legible.
  3. Distribution administrationUneven, frequent cashflows across many holders is exactly the arithmetic that goes wrong by hand.

How it works

  1. Loans are originated or acquiredA vehicle holds the loan tape and the security.
  2. Units represent a claim on the poolInvestors hold a proportional interest rather than specific loans, unless the structure is single-asset.
  3. Collections are distributedInterest and principal received are passed through on a schedule, net of fees and reserves.
  4. Losses are absorbed by the waterfallDefaults reduce distributions according to the documented order of priority.

Architecture

A vehicle holding the loans; a servicer collecting and reporting; a valuation basis that accounts for expected credit loss rather than face value; and a distribution engine capable of running frequently and unevenly.

How the platform is arrangedFour stages — asset, compliance, offering and register — connected left to right, all enclosed by a single transaction boundary that rests on a double-entry ledger.AssetStructured and documentedCompliancePolicy in forceOfferingA book that is derivedRegisterHolders of recordOne transaction boundaryA movement and the entries behind it commit together, or neither doesDouble-entry ledgerEvery movement, both sides, in minor unitsBalanced at COMMIT
Four stages inside one transaction boundary, on one ledger. A register that disagrees with the cash is not a state the software can reach.

Tokenization lifecycle

  1. OriginationLoans underwritten, documented and secured.
  2. Warehouse and issueThe vehicle acquires the tape; units are issued.
  3. Collection and distributionScheduled and unscheduled cashflows passed through.
  4. WorkoutArrears, restructuring and recovery on defaulted loans.
  5. Wind-downFinal recoveries distributed; units retired.

Supported token model

Permissioned fungible token over a pool; non-fungible where a single loan is represented. A pooled interest is interchangeable and therefore fungible. A single identified loan is not — it has its own borrower, term and security — and forcing it into a fungible model would misrepresent what the holder owns.

Asset requirements

What must be true before this can responsibly be tokenized at all.

  • A loan tape with documented underwriting standards.
  • A servicer with the capacity to collect, report and pursue arrears.
  • A valuation basis that reflects expected credit loss, and who signs it.
  • A documented waterfall covering fees, reserves, interest and principal, and what changes on default.

Compliance considerations

  • Lending licences are jurisdiction-specific and are a precondition, not a formality.
  • Borrower data is personal data; the register must not leak it to investors.
  • Investor eligibility is typically restricted to professional investors given the illiquidity and loss profile.
A compliance policy as ordered rulesRules are evaluated in sequence and the first match decides. A subject matching no rule is denied, and a fact the platform does not know never satisfies a rule.Subjectan investor's facts#1Screening hit is openreject#2Country in the blocked listreject#3Professional or institutional, verifiedallowMatched no ruledenyFirst matchdecides. A laterallow cannot undoan earlier reject.Eligibility comesfrom a rule saying so.
Rules are data, evaluated in sequence, and the first match decides. A subject matching nothing is denied — eligibility comes from a rule saying so, never from no rule objecting.

Investor workflow

  • Verify and be assessed against the eligibility policy.
  • Subscribe during an open window and fund by reference.
  • Receive distributions as collections arrive, which will be uneven.
  • Exit at maturity or wind-down; secondary transfer is usually restricted.

Issuer workflow

  • Establish the vehicle and appoint the servicer.
  • Configure the waterfall and the reporting cadence.
  • Issue units against committed capital.
  • Run distributions as collections arrive, and report arrears honestly.
  • Manage workouts and wind down.

Payments

Collections fund a distribution pool; the pool is split across holders of record exactly, with the lines summing to what was funded. Reserves and fees are taken before the pool is struck, so what is distributed is what is actually available.

The payment railMoney is matched to a subscription by its reference and no other attribute, then screened and settled. Provider adapters for card and crypto rails are not built, and are drawn as an absent component.ReferencechecksummedFunds arrivebank or custodyReconcilereference or nothingScreenAMLSettlesecond authoriserSuspense (2900)unidentified, and visibleNo reference matchProvider adaptersCard, local rail, stablecoinNot built — the registry ships empty
A reference is the only thing that matches money to a payment. Everything else is an exception for a person, and unidentified credits post to suspense where they stay visible.

Lifecycle servicing

This is the most servicing-intensive asset class on the platform. Distributions are frequent and uneven, arrears reporting matters as much as payment, and a restructuring is a corporate action with real consequences for holders.

How a distribution is splitA funded pool is divided among holders of record as at the record date using largest-remainder allocation, then withholding is deducted from each holder's gross rather than from the pool.Funded poolone exact amountRegister as atthe record dateRebuilt from confirmedmovements, not today’sbalancesNet to the holderWithheld, from that holder’s grossThe lines sum to exactly what was fundedLargest-remainder allocation, so no minor unit is created or lost. Rounding each slice independently leaves the issuer a few units out every cycle.There is no per-jurisdiction withholding matrix in this build — one rate is entered per run.
Holders of record as at the record date, split by largest remainder so the lines sum exactly, with withholding taken from each holder’s gross rather than off the top of the pool.

Secondary transfer

Usually restricted. Where permitted, the transfer gate applies and the buyer must be eligible; pricing a private credit interest without a NAV is the practical constraint rather than the mechanism.

The transfer gateA transfer request passes through eight compliance checks. Any single failure refuses the transfer; the same gate is evaluated off-chain and on-chain.Senderholds unitscanTransfer( )Sender holds the unitsNeither party frozenLockup expiredRecipient eligible under policyJurisdiction permittedInvestor type permittedHolding limit not breachedSanctions screening clearRecipientunits move, or none doOne implementation. The Solidity module and the register evaluate the same rules.
One implementation of the gate, not two. The function the register calls is the same one that mirrors the Solidity compliance module check for check, so an off-chain gate and an on-chain gate cannot drift.

Risks

Named plainly. An instrument whose risks are only in a footnote has been mis-sold before it has been issued.

  1. Credit lossBorrowers default. The question is not whether but at what rate, and whether the reserves and the waterfall were honest about it.
  2. Valuation subjectivityMarking a private loan book is a judgement, and optimistic marks are the most common way losses are deferred rather than avoided.
  3. Servicer dependenceCollections stop if the servicer stops. A backup servicing arrangement is not optional at scale.
  4. IlliquidityThere is usually no exit before maturity. An instrument sold as accessible must not be sold as liquid.

How we support it

  • Distributions that can run frequently and unevenly without the arithmetic drifting.
  • Corporate actions for restructurings, with a plan that is previewed and re-checked against the register before it applies.
  • A ledger where reserves, fees and investor money are distinct balances rather than one bank figure.

Questions

Can investors see the individual loans?

At the level of aggregate performance and characteristics, yes. Borrower identity is personal data and is not disclosed to investors.

What happens when a loan defaults?

It flows through the waterfall as documented, and it is reported. The platform will not smooth a distribution to conceal it.

Is there a secondary market?

Rarely a meaningful one. Assume the position is held to maturity and treat any secondary liquidity as a bonus.

Next steps

Bring an instrument you are actually considering. Structuring something real is the only way to judge whether the model fits.

Request Enterprise DemoAll tokenization topics